Privacy Policy

Scope and responsibility

This Privacy Policy explains how First Page handles personal information when you use firstpageapp.com, the screenplay editor, related desktop clients, support, and billing. First Page is responsible for the account and document data described here. Stripe separately controls payment-card information submitted through its checkout and billing portal.

Account information

We collect the name, email address, account identifiers, email-verification state, and authentication records needed to operate your account. Password credentials are processed through Better Auth and stored as secure hashes; First Page does not store your plaintext password. If you sign in with a passkey, we store its public key, its credential identifier, a counter and what your device reports about it (whether it syncs, and how it connects). We never store the passkey's private key, which your device or password manager keeps, and the part of it that opens your scripts never reaches us. We also store onboarding state and basic workspace preferences.

Screenplay and workspace content

When you save a screenplay to First Page's cloud, your device encrypts it before it reaches us: the screenplay text, title-page information, notes, beats, revisions, and formatting settings, along with each screenplay's title and your folder names. Only you hold the key, and, for a script you share, the people you share it with. Once your account has a key, our database refuses to store a readable copy. Screenplays stored before your account had a key stay as they were, as readable copies, until you choose to encrypt them from your library or save them again. Then your device encrypts them and the encrypted copies replace the readable ones. On the web, your browser keeps the key after you sign out, so signing back in opens your scripts; Lock and sign out, or the setting to lock when you sign out, makes it forget the key. We store the encrypted data and what is needed to sync it, including a random identifier for each screenplay, its folder, a size rounded up to a standard step, and when it was created and last changed. Local recovery copies and pending sync operations may also be stored in your browser or desktop client.

If you share a script, the people you share it with can read it and write in it on their own devices. Its key is sealed to each of them, and we still cannot read it. We hold their names, email addresses and roles on the script, and never its title or words. Removing someone takes the script away: we stop sending it to them, and their apps delete their copy the next time they connect. The script moves to a new key soon after, from the next device that edits it and can pass the new key to every owner. Nothing written under the new key can be opened with the old one. Until then, new writing is still under the old key. We can't take back files they exported, printed or saved outside First Page. A hostile server could swap a collaborator's key for its own and be given the script key by the next device that shares it with them. The only sign is a quiet line saying their encryption was reset, unless you compare safety codes. This is the trade mainstream encrypted messengers make. Someone removed from a script, working with a hostile server, could also give a key of their own to a member's device that holds the script's old key but has never opened the script. They could then read what is written on that device.

We do not sell screenplay content, use it for advertising, or use it to train generative models. People working on First Page cannot read screenplays stored with end-to-end encryption, and support does not need them: support codes and diagnostics never include your writing.

When you ask for an Analysis read, your device sends the draft through our servers to Anthropic for that read, and we keep no copy of it. We hold the notes only until your device collects them, normally within a second; your device then encrypts them with your key, and only that encrypted copy is kept. Notes that are never collected are deleted after 24 hours. When you play a scene with studio voices, its text is sent through our servers to ElevenLabs to perform it. We do not store the audio on our servers; your device keeps recently played audio so it replays without being sent again. Listen with the voices on your Mac sends nothing off your Mac. Neither Anthropic nor ElevenLabs uses what we send them to train its models.

How end-to-end encryption, Listen, and Analysis handle your scripts, and what we can still see, is explained in plain language on Your writing stays yours.

Technical and usage information

Our infrastructure may process IP address, browser and device type, operating system, request timestamps, route and response status, session identifiers, approximate region, and diagnostic information.

With your opt-in consent, PostHog receives a limited set of typed product events about activation, sign-in, license state, Reader or editor use, and export format. It also receives events about setting up and unlocking encryption, pairing a device, copying or encrypting older scripts when you choose to, saving and syncing to the cloud, using Listen and Analysis, and sharing a script. It also receives page views, clicks on our marketing pages, the plan you pick on the pricing page and whether checkout started or failed, when an upgrade prompt was shown, and checks for and installs of app updates. Each event's own details are a fixed kind, a count, or a duration. For sharing, that is how many people were invited in one invitation, whether a shared script opened for editing or reading, what you are on it (the first owner, an owner, or an editor), how many lines gained a mark for two versions, how many people a background run sealed the script's key for, and why a shared script held or refused your edits (your plan does not include editing, you were removed, the script is in the trash, the app needs an update, or the script is too large). Each event also carries the address of the page it happened on and of the page or site you came from, which can be outside First Page, each with any script's id, query and fragment taken out, so a script page reads as /documents/[id]. PostHog's library also sends its standard details with each event: your browser or the Mac app and its version, on the web the browser's user agent, your operating system, device type, screen and window size, language and time zone, the library's version, and random ids for this device and this session. Once you sign in, events also carry your account id, so they can be counted per account. PostHog also receives your IP address with each event and uses it to work out an approximate location. Analytics never includes who was invited, which script it was, or anything written in it. Analytics explicitly excludes screenplay text, titles, filenames, notes, file paths, authentication tokens, and session recordings. You can withdraw consent at any time in the website footer or Mac settings.

When something fails, Sentry receives an error report: the kind of error, where in the code it happened, the app version, browser or operating system, and an account identifier on reports from our servers. Reports from the website pass through our servers first, so Sentry does not receive your IP address. Error reports exclude screenplay text, titles, folder names, filenames, notes, the file paths on your device, and web addresses. An error's message is kept only when it has one of a few fixed forms that cannot contain anything you wrote. On the Mac you can turn crash reports off in Settings, under Privacy.

If you choose Send diagnostics, we receive the report shown to you before sending: app version, operating system and browser family, processor type, encryption status and which recovery methods are set up, counts of pending changes and sync problems, and recent errors with their support codes. We keep it, and records of failed requests, for 30 days.

Billing information

Stripe processes card numbers and other payment credentials. First Page receives Stripe customer, checkout, subscription, price, invoice status, cancellation, and payment-event identifiers so we can activate and manage First Page One, Suite, and Lifetime entitlements. We do not receive or store complete card numbers or card security codes.

Cookies and local storage

First Page uses essential session cookies to keep you signed in and protect authenticated requests. Browser storage is used for account-scoped draft recovery, settings, version history, pending cloud mutations, conflict ownership, diagnostic state, and your analytics consent choice. We do not use third-party advertising cookies or cross-site advertising profiles. Blocking essential storage may prevent authentication, recovery, or offline-safe editing from working correctly.

How we use information

• authenticate users and secure accounts;
• store, synchronize, recover, organize, and export screenplays;
• process billing and enforce workspace limits;
• send verification, password-reset, billing, and service messages;
• diagnose errors, prevent abuse, and improve reliability;
• respond to support requests and product feedback; and
• comply with legal obligations and enforce our terms.

Service providers

We use a limited set of processors to operate First Page:

• Cloudflare for application hosting, security, DNS, and transactional email;
• Neon for managed PostgreSQL database infrastructure;
• Stripe for checkout, subscriptions, invoices, refunds, and payment management;
• Anthropic, only when you ask for an Analysis read, to read the script and return notes;
• ElevenLabs, only when you play a scene with studio voices, to perform the lines you choose to hear;
• PostHog for opt-in, privacy-limited product analytics; and
• Sentry for error and crash reports that exclude screenplay content.

These providers may process data in multiple countries under their own security and privacy commitments. We share only information reasonably necessary for the service they provide.

When information is shared

We do not sell personal information. We may disclose information to the providers above; when you direct us to share or export content; to comply with valid legal process; to protect users, the public, or the service; or as part of a financing, merger, acquisition, reorganization, or sale of assets. A successor must honor this policy for data it receives.

Retention and deletion

We retain account and active workspace data while your account remains open. Deleted or archived records may remain in backups, security logs, or recovery systems for a limited period before being overwritten. Billing and transaction records may be kept longer where tax, accounting, fraud, or legal rules require it. Opt-in analytics is retained under our configured PostHog retention period. Account deletion removes First Page account and cloud content immediately after email confirmation; a verified support request also removes or anonymizes linked PostHog analytics. Local browser data remains on your device until First Page, you, or the browser removes it.

Security

We use end-to-end encryption for screenplays, titles, and folder names kept in the cloud, authenticated access, encrypted network transport, account-scoped database ownership checks, secret-managed infrastructure, revision-safe document writes, and restricted operational logging. No system can guarantee absolute security. Use a unique password, protect your devices, and export independent backups of important work.

Your choices and privacy rights

You can edit many account and document fields directly, export your screenplays, cancel a paid plan through Stripe, manage connected devices, and permanently delete your account from Account settings. Depending on where you live, you may also have rights to access, correct, delete, restrict, object to, or receive a portable copy of personal information.

Send requests from the account email to support@firstpageapp.com. We may verify identity before acting. You may appeal a denied request or contact your local privacy authority where applicable.

Communications

Verification, password-reset, security, billing, and material service notices are operational and cannot always be opted out of while the account remains active. We will provide an unsubscribe method before sending optional marketing email. First Page does not currently send third-party advertising email.

International processing

First Page and its providers may process information in the United States and other countries. Those locations may have different data-protection rules. Where required, transfers rely on recognized contractual or legal safeguards. By using the service, you understand that processing may occur outside your country of residence.

Children

First Page is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has created an account without required permission, contact us so we can investigate and delete the account where appropriate.

Policy changes and contact

We may update this policy as First Page changes. Material updates will be posted with a new effective date and, where appropriate, communicated in the product or by email. Privacy questions and requests may be sent to support@firstpageapp.com.